CVE-2026-49229: Actual is a local-first personal finance app. Prior to 26.6.0, in OpenID multi-user mode, disabling a user only blocks future OpenID login for that identity, while existing Actual

highCVSS 8.3CVE-2026-49229

Actual is a local-first personal finance app. Prior to 26.6.0, in OpenID multi-user mode, disabling a user only blocks future OpenID login for that identity, while existing Actual session tokens for the disabled user remain valid. The shared session validation path accepts any existing token row that has not expired without checking whether the associated user is still enabled, allowing a disabled user to continue calling authenticated server endpoints. This issue is fixed in version 26.6.0.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: high — CVSS 8.3
Published: 2026-07-07
Last updated: 2026-07-09
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-49229

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-492290.44% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 36% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-49229	coverage & exploitation status	NVD · CVE.org

Recent advisories for Actual is a

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

mediumCVE-2026-59938: pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craf…nvd · 2026-07-08
mediumCVE-2026-50179: Actual is a local-first personal finance tool. Prior to 26.6.0, exportToCSV and exportQueryToC…nvd · 2026-07-07
unknownCVE-2026-50007: Actual is an open-source personal finance application. Prior to 26.7.0, a missing authorizatio…nvd · 2026-07-07
mediumCVE-2026-46700: Actual is a local-first personal finance tool. Prior to 26.6.0, the GET /secret/:name endpoint…nvd · 2026-07-07
mediumCVE-2026-46672: Actual is a local-first personal finance app. Prior to 26.6.0, @actual-app/cli ships a hand-ro…nvd · 2026-07-07
mediumCVE-2026-53146: thunderbolt: Limit XDomain response copy to actual frame sizemsrc · 2026-06-09

CVE-2026-49229: Actual is a local-first personal finance app. Prior to 26.6.0, in OpenID multi-user mode, disabling a user only blocks future OpenID login for that identity, while existing Actual

Details

Exploitation outlook

Referenced CVEs

Recent advisories for Actual is a

More from NVD Recent CVEs